Privacy Policy
Last updated: 7 October 2026
This policy explains how Ischia Spaeh Srl processes the personal data of people who visit www.ischiaspaeh.it, buy our products, subscribe to our newsletter or contact us. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code). Details on cookies and tracking tools are in our Cookie Policy.
1. Data controller
Ischia Spaeh Srl
Via Nuova Cartaromana, 111 · 80077 Ischia (NA), Italy
VAT no. IT06956161217 · REA Napoli 851619
Email for privacy requests: team@ischiaspaeh.it
2. What data we collect
- Data you give us: first and last name, email, phone number, shipping and billing addresses, tax code or VAT number if you need an invoice, the content of your messages, your answers to the "Find your ritual" questionnaire, and details about your business if you fill in the form for professionals.
- Purchase data: products ordered, amounts, discount codes used, order history, returns.
- Payment data: handled directly by the payment providers. We never see or store your full card number.
- Browsing data: IP address, device and browser type, pages visited, where your visit came from, interactions with the site. Part of this is collected through cookies and similar tools, only within the choices you make in the cookie banner.
- Data about the emails we send you: whether you open an email or click a link, so we know which content interests you and can stop writing to you if you no longer read our emails.
Please do not include in forms or messages any information about your health that is not necessary. The questionnaire answers describe your skin (for example "dry" or "sensitive") and are used only to recommend products.
3. Why we process your data and on what legal basis
| Purpose | Legal basis | How long |
|---|---|---|
| Managing your order: payment, shipping, customer service, returns, warranties | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the relationship, then up to 10 years for tax and accounting obligations |
| Complying with legal obligations: invoices, accounting, requests from authorities | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 2220 Italian Civil Code) |
| Replying to messages you send by email, contact form or WhatsApp | Pre-contractual measures or our legitimate interest in replying (Art. 6(1)(b) and 6(1)(f)) | As long as needed to handle the request, then up to 24 months |
| Sending you our newsletter, promotions and automated marketing emails (for example welcome, abandoned cart, routine tips) | Consent (Art. 6(1)(a)), which you can withdraw at any time | Until you withdraw consent. If you do not open our emails for a long time, we stop writing to you |
| Sending customers emails about products similar to those they bought (for example a reorder reminder) | Legitimate interest, within the limits of Art. 130(4) of the Italian Privacy Code. You can object at any time, including via the link at the bottom of every email | Until you object |
| Recommending suitable products based on your answers to the "Find your ritual" questionnaire and sending you the result with the discount code | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Replying to requests from professionals (hotels, spas, beauty salons, pharmacies) sent through the dedicated form | Pre-contractual measures (Art. 6(1)(b)) | 24 months from the last contact |
| Sending you the free guide requested through Facebook and Instagram forms, and the related emails | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Asking you for a review after your purchase through Trusted Shops | Legitimate interest in collecting feedback on the products sold (Art. 6(1)(f)), with the right to object | According to Trusted Shops' retention periods |
| Statistics on how the site is used and measurement of advertising campaigns | Consent given in the cookie banner (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code) | See the Cookie Policy |
| Showing you advertising on Facebook, Instagram and Google that is closer to your interests, including by using, in encrypted form, the email addresses of subscribers and customers to create audiences | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Protecting the site from spam, fraud and abuse; defending our rights in court | Legitimate interest (Art. 6(1)(f)) | Only as long as strictly necessary, unless there is a dispute |
Data that is essential to fulfil an order or answer a request is mandatory: without it we cannot do so. All other data is optional, and refusing to provide it has no effect on your purchase.
4. Profiling
If you give us your consent, we group contacts based on purchases, questionnaire answers and email interactions, so we can send you more relevant communications. We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.
5. Who we share data with
Your data is processed by our authorised staff and by the providers who help us run the shop. They act as data processors under a contract, or as independent controllers when they process data for their own purposes (for example payment services). The main ones are:
- Shop platform: Shopify International Limited (Ireland), including Shop Pay and the Shop app.
- Payments: Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay and the card networks (Visa, Mastercard, American Express, Maestro, UnionPay), Bancontact, iDEAL, MobilePay, Wero, as well as bank transfer and cash on delivery where available.
- Shipping: the couriers in charge of delivery, to whom we pass your name, address and phone number for delivery.
- Email and messaging: Klaviyo, Inc. (newsletter, automated emails, sign-up forms); WhatsApp (Meta Platforms Ireland Limited) if you chat with us; the WhatsApp button on the site is provided by BeeApp.
- Reviews: Trusted Shops SE (Germany).
- Wishlist: Swym Corporation.
- Store locator map: Stockist.
- Analytics and measurement: Google (Google Analytics 4, Google Tag Manager), Microsoft (Clarity), Analyzify, Uptonica.
- Advertising: Google Ireland Limited (Google Ads) and Meta Platforms Ireland Limited (Facebook and Instagram, including lead forms).
- Security: hCaptcha (Intuition Machines, Inc.) on the site forms.
- Consultants and agencies: the agency that manages the site and marketing, tax and legal advisers.
We may disclose data to authorities when required by law. We do not sell your data.
6. Transfers outside the European Union
Some providers are based, or have servers, outside the European Economic Area, in particular in the United States (for example Klaviyo, Google, Meta, Microsoft) and Canada (Shopify). In these cases the transfer is based on an adequacy decision of the European Commission (for the United States, with companies certified under the EU-US Data Privacy Framework) or on the standard contractual clauses approved by the Commission. You can ask us for more information at the address above.
7. Your rights
At any time you can ask us to:
- access your data and receive a copy;
- correct or update it;
- erase it, where we are not required by law to keep it;
- restrict its processing;
- receive it in a machine-readable format to transfer it to another controller (portability);
- object to processing based on legitimate interest and, always and without giving reasons, to marketing;
- withdraw your consent, without affecting the lawfulness of processing carried out before.
To stop receiving emails, just use the "unsubscribe" link at the bottom of every message. To change your cookie preferences, use the "Cookie preferences" link at the bottom of every page. For anything else, write to the address in section 1: we reply within one month.
If you believe your data is not being processed correctly, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the country where you live.
8. Security
We take appropriate technical and organisational measures to protect data against loss, unauthorised access and misuse. The site uses an encrypted connection (HTTPS) and payments are processed on the providers' certified systems.
9. Minors
The site is not intended for people under 18, who may not make purchases. We do not knowingly collect data from children under 14: if we find that we have received it, we delete it.
10. Changes
We may update this policy when the services we use or the law change. The date of the last update is shown at the top of the page. If changes affect processing based on consent, we will ask for your consent again where necessary.